Basement Hacker

Dogmatic and confused being set straight by @Digidaunted. life long electronics hacker. Author, IT, DFIR and Dad.

[Merill Fernando @merill]

👋 Folks, I'm starting a new series of Entra Hardening tips from today.

Here's how it will work. One new tip every weekday (I take a break on weekends).

----
Tip #1: Privileged accounts in Entra ID should be cloud native identities

If your privileged accounts in Entra ID are synced from on-prem AD then you have a problem.

Attackers that compromise your on-prem infrastructure can pivot to the cloud, into Entra ID and gain access to the cloud servers, data, Microsoft 365 and other SaaS apps.

Why?
We've seen this happen multiple times. The biggest ones have been Solorigate (compromise ADFS and pivot to cloud), other examples include Storm-0501 (compromise AAD Connect server) and more.

The Fix?
Reduce the blast surface. Don't allow accounts synced from on-prem to be granted privileged roles.

Instead create admin accounts natively in Entra ID and grant privileged roles to these cloud only accounts.

[Matt Edmondson @matt0177]

By far the coolest @BlackHatEvents prize I’ve ever won!

[Basement Hacker @basementhacker]

@letswastetime @InfoSecSherpa @THOR_Collective Totally subscribed great content thanks!

[Basement Hacker @basementhacker]

@letswastetime @InfoSecSherpa @THOR_Collective Well this has led down a rabbit hole and finding out my whole process needs serious improvements. The more you learn the more you realize how much you truly don’t know. This is a good thing.

[Basement Hacker @basementhacker]

@letswastetime @InfoSecSherpa @THOR_Collective Great article. Led me to this and this is amazing https://t.co/RGB7vwGAEW (3) Stop Chasing Ghosts: How Five-Number Summaries Reveal Real Anomalies

[Hackster.io @Hacksterio]

Matt Bowes saves an Amstrad ALT-286 from the scrapheap, turns it into a beast of a sleeper build. https://t.co/2wUh9s30np

[Blue Team News @blueteamsec1]

From NTLM relay to Kerberos relay: Everything you need to know https://t.co/nuFZGsW2Fs #cyber #threathunting #infosec

[Basement Hacker @basementhacker]

@Carlos_Perez Is that the guy with the bad motivator in episode 4?

[Virus Bulletin @virusbtn]

Proofpoint threat researchers have recently uncovered an active account takeover (ATO) campaign, tracked as UNK_SneakyStrike, using the TeamFiltration pentesting framework to target Entra ID user accounts. https://t.co/d6u1WZ9Di3

[Basement Hacker @basementhacker]

Wow there is a goldmine of information at this github!!

[LetsDefend @LetsDefendIO]

Wireshark CheatSheet for Log Analysis

[adafruit industries @adafruit]

Macropad with a CNC rotary encoder and the Feather RP2040 running CircuitPython https://t.co/b2AYTk3Z70 #adafruit #3dprinting https://t.co/uR0LXtv82t

[Basement Hacker @basementhacker]

@emptywheel @dieworkwear I believe that may be a dickey a partial shirt kind of like yes a bib. Sorry I just thunk that word is funny dickey

[Basement Hacker @basementhacker]

@JocAPhotography Wow the reflection on the water this is a great photo!

[Basement Hacker @basementhacker]

@ThatEricAlper Making good money delivering the local newspaper.

[All The Right Movies @ATRightMovies]

TRON was released 42 years ago today. A groundbreaking blend of concept and digital effects, and a film that launched the career of actor Jeff Bridges, the story of how it came to be is as thrilling as a Light Cycle…

1/47

[adafruit industries @adafruit]

Build an IoT Filament sensor for your 3D printer https://t.co/BVl105LvPv #3dprinting #adafruit https://t.co/h1JrcWNsrh

[Basement Hacker @basementhacker]

@ThatEricAlper Jesus built my hot rod. The long version.

[Basement Hacker @basementhacker]

@Xbox @amazonfiretv Bummer just got fire cube a few months ago

[Xtheband @Xtheband]

Forgot how to post here for a second... but Hey! Good news! The ninth and final album ‘Smoke & Fiction’ is in stores August 2nd.

Listen to ‘Big Black X’ now & we’ll be seeing you on the road soon. Go to https://t.co/9vPO15Rq8b to pre-order CD / LP

[Lukas Beran @lukasberancz]

This one is really important in case of a cybersecurity incident / account compromise.

Microsoft Entra ID uses different tokens for different purposes. A general feature of tokens is that they keep logins active.

What is the token lifetime? Expiration? What are the token revocation options for different types of Microsoft Entra ID tokens?
👇👇
https://t.co/1on5QkGvyK

#cswrld #entraid #token #revocation #expiration #cybersecurity #tips